CVE-2020-36872— BACnet Test Server 1.01 Malformed BVLC Length DoS
Quick assessment
Affected
BACnet Interoperability Test Services, Inc. BACnet Test Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BACnet Test Server是美国BACnet公司的一个BACnet协议设备的测试工具。 BACnet Test Server 1.01及之前版本存在资源管理错误漏洞，该漏洞源于BACnet/IP BVLC数据包处理中未正确验证BVLC Length字段，可能导致拒绝服务攻击。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| BACnet Interoperability Test Services, Inc. | BACnet Test Server | ≤ 1.01 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-36872
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BACnet Test Server 1.01 Malformed BVLC Length DoS
Source: CVE Program / CVE List V5
Vulnerability Description
BACnet Test Server versions up to and including 1.01 contains a remote denial of service vulnerability in its BACnet/IP BVLC packet handling. The server fails to properly validate the BVLC Length field in incoming UDP BVLC frames on the default BACnet port (47808/udp). A remote unauthenticated attacker can send a malformed BVLC Length value to trigger an access violation and crash the application, resulting in a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
BACnet Test Server 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
BACnet Test Server是美国BACnet公司的一个BACnet协议设备的测试工具。 BACnet Test Server 1.01及之前版本存在资源管理错误漏洞，该漏洞源于BACnet/IP BVLC数据包处理中未正确验证BVLC Length字段，可能导致拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| BACnet Interoperability Test Services, Inc. | BACnet Test Server | 0 ~ 1.01 | - |
|
II. Public POCs for CVE-2020-36872
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-36872
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-36872 (1)
-
BACnet Test Server 1.01 Malformed BVLC Length DoS | Advisories | VulnCheck third-party-advisory
Exploits & Public PoCs for CVE-2020-36872 (3)
-
-
-
🔗 Zero Science Lab » BACnet Test Server 1.01 Remote Denial of Service Exploit Read full article technical-description exploit
IV. Related Vulnerabilities
Same weakness: CWE-400
-
CVE-2026-84375
js-yaml: maxTotalMergeKeys does not limit CPU use for empty -
CVE-2026-84364
Hono: Unbounded dot-notation nesting in `parseBody()` can ca -
CVE-2026-84304
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame -
CVE-2026-83619
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic back -
CVE-2026-83614
xmldom: Quadratic-time parsing via the malformed-input recov
V. Comments for CVE-2020-36872
No comments yet